QMail

Getting this going under QMail turns out to be a real challenge, since QMail doesn't have the same level of programmability that Sendmail has. Hence, we need to employ an additional script to grab the IP address from the headers. (Thanks to Russell Nelson for confirming QMail's behavior here.)

QMail has a very specific means of adding Received: lines to messages, making them relatively easy to parse. For example, the following headers are typical:

Return-Path: <emarshal@xnet.com>
Delivered-To: emarshal@LOGIC.NET
Received: (qmail 26029 invoked from network); 13 Oct 1997 15:04:13 -0000
Received: from quake.xnet.com (HELO mail.xnet.com) (198.147.221.35)
  by labyrinth.logic.net with SMTP; 13 Oct 1997 15:04:13 -0000

We can disregard the Return-Path: and Delivered-To: lines; they're unimportant to us. The Received: headers are the most interesting. The first Received: line we'll see is the local delivery of the mail; hence, the "qmail 2609 invoked from network". The second Received: line is the most important to us; it's the one which contains the IP address of the sender...in this case, 198.147.221.35. To complicate things, the "(HELO mail.xnet.com)" section may not exist, and the IP address might have ident information prepended to it (like "qmailr@198.147.221.35").

Two programs are provided to help you retrieve this information automatically from the headers, both with the same semantics. "origip.c" compiles into "origip", and for those who have trouble compiling it (if you do, please email me with any errors), "origip.awk" is provided which behaves the same way.

Essentially, you pass either of these programs an email message, and they in turn extract the sending address and either print it back to you, or exit with a non-zero return value.

To use this in procmail, just use:

TCPREMOTEIP=`origip || echo 127.0.0.1`

This will pipe the message through origip (replace origip with "origip.awk" in the case of using the awk script), and will capture the address. If there is an error, we'll default to 127.0.0.1, which will allow the mail through.

(If you're undecided which program of the two you want to use, consider that the C version is much faster, and will be maintained more than the awk script. However, the C version is probably more prone to bugs. ;-)

Once you have that line in place, go ahead and use the procmail recipe supplied above in good health.